Review frequency should follow materiality. A vendor whose agents prepare credit files for lending decisions warrants closer ongoing monitoring than a low-risk internal tool, including review of performance reports, change logs, incidents and subcontractor changes. Trigger an extra review whenever the vendor changes an underlying model or expands an agent's authority.
